+ # out of window are dropped
+ pkt = (Ether(src=self.tra_if.remote_mac,
+ dst=self.tra_if.local_mac) /
+ p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
+ dst=self.tra_if.local_ip4) /
+ ICMP(),
+ seq_num=17))
+ self.send_and_assert_no_replies(self.tra_if, pkt * 17)
+
+ if use_esn:
+ # an out of window error with ESN looks like a high sequence
+ # wrap. but since it isn't then the verify will fail.
+ self.assert_packet_counter_equal(
+ '/err/%s/Integrity check failed' %
+ self.tra4_decrypt_node_name, 34)
+
+ else:
+ self.assert_packet_counter_equal(
+ '/err/%s/SA replayed packet' %
+ self.tra4_decrypt_node_name, 20)
+
+ # valid packet moves the window over to 236
+ pkt = (Ether(src=self.tra_if.remote_mac,
+ dst=self.tra_if.local_mac) /
+ p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
+ dst=self.tra_if.local_ip4) /
+ ICMP(),
+ seq_num=236))
+ rx = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
+ decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
+
+ # move VPP's SA to just before the seq-number wrap
+ self.vapi.cli("test ipsec sa %d seq 0xffffffff" % p.scapy_tra_sa_id)
+
+ # then fire in a packet that VPP should drop because it causes the
+ # seq number to wrap unless we're using extended.
+ pkt = (Ether(src=self.tra_if.remote_mac,
+ dst=self.tra_if.local_mac) /
+ p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
+ dst=self.tra_if.local_ip4) /
+ ICMP(),
+ seq_num=237))
+
+ if use_esn:
+ rx = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
+ # in order to decrpyt the high order number needs to wrap
+ p.vpp_tra_sa.seq_num = 0x100000000
+ decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
+
+ # send packets with high bits set
+ p.scapy_tra_sa.seq_num = 0x100000005
+ pkt = (Ether(src=self.tra_if.remote_mac,
+ dst=self.tra_if.local_mac) /
+ p.scapy_tra_sa.encrypt(IP(src=self.tra_if.remote_ip4,
+ dst=self.tra_if.local_ip4) /
+ ICMP(),
+ seq_num=0x100000005))
+ rx = self.send_and_expect(self.tra_if, [pkt], self.tra_if)
+ # in order to decrpyt the high order number needs to wrap
+ decrypted = p.vpp_tra_sa.decrypt(rx[0][IP])
+ else:
+ self.send_and_assert_no_replies(self.tra_if, [pkt])
+ self.assert_packet_counter_equal(
+ '/err/%s/sequence number cycled' %
+ self.tra4_encrypt_node_name, 1)
+